Enable CILogon for binder-staging hub #1579
Conversation
|
I deployed this but I don't think it's working as there isn't a login page |
|
I actually may be missing some config: |
Co-authored-by: Georgiana Elena <[email protected]>
for more information, see https://pre-commit.ci
sgibson91
force-pushed
the
cilogon-binder
branch
from
8b0ed72 to
8110897
Compare
|
I've got a really unhelpful error from the helm chart validation which I assume is related to the regex for username_pattern: I tried using a double backslash but that didn't work Update: Apparently the type of quotation mark matters for deployment, validation still failing though |
|
Config still not working though. Getting a 500 internal error |
| - http://google.com/accounts/o8/id: | ||
| username_derivation: | ||
| username_claim: "email" | ||
| username_pattern: '^(.+@2i2c\.org|deployment-service-check)$' |
There was a problem hiding this comment.
@sgibson91, maybe adding the username_pattern under hub.config.Authenticator like in
infrastructure/config/clusters/2i2c/dask-staging.values.yaml
Lines 50 to 55 in 22c4423
When I made the suggestion of adding it here, I assumed it would work this way too, since CILogonOAuthenticator is inheriting from the base Authenticator
There was a problem hiding this comment.
Thank you, will try that
I also seem to have acquired two instances of username_claim like this:
CILogonOAuthenticator:
oauth_callback_url: "https://binder-staging.2i2c.cloud/hub/oauth_callback"
username_claim: "email"
allowed_idps:
- http://google.com/accounts/o8/id:
username_derivation:
username_claim: "email"
I'm assuming one of these is wrong?
|
This config is completely busted and I don't know why. On the upside, the hub is unusable, cryptominers or no |
|
I killed the proxy-public service to make the whole hub go away and I'll disable updates in CI so that we don't bring it back up with another merge |
|
This was incorporated in #2393 |
We had a cryptomining incident on the binder-staging hub on the 2i2c cluster so I am enabling CILogon so only those with 2i2c.org email addresses can access the hub for now